Maven/org.xwiki.platform:xwiki-platform-web-templates CVE-2024-43401: critical 9, EPSS 0.68%
In XWiki Platform, payloads stored in content is executed when a user with script/programming right edit them
Action: Upgrade org.xwiki.platform:xwiki-platform-web-templates to 15.10-rc-1 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 15.10-rc-1 | - |
Fixed versions
| 15.10-rc-1 |
Sources
- osv: GHSA-f963-4cq8-2gw7
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-f963-4cq8-2gw7
- https://nvd.nist.gov/vuln/detail/CVE-2024-43401
- https://github.com/xwiki/xwiki-platform
- https://jira.xwiki.org/browse/XWIKI-20331
- https://jira.xwiki.org/browse/XWIKI-21311
- https://jira.xwiki.org/browse/XWIKI-21481
- https://jira.xwiki.org/browse/XWIKI-21482
- https://jira.xwiki.org/browse/XWIKI-21483
- https://jira.xwiki.org/browse/XWIKI-21484
- https://jira.xwiki.org/browse/XWIKI-21485
- https://jira.xwiki.org/browse/XWIKI-21486
- https://jira.xwiki.org/browse/XWIKI-21487
- https://jira.xwiki.org/browse/XWIKI-21488
- https://jira.xwiki.org/browse/XWIKI-21489
- https://jira.xwiki.org/browse/XWIKI-21490
CVE-2024-43401 · published · modified · JSON